APT-C-60 Spear-Phishing Campaign Against Japanese Recruiters Using VHDX/LNK and SpyGlace Malware

Key facts for APT-C-60 Japanese Recruiter Lure

Detection coverage for APT-C-60 Japanese Recruiter Lure

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2134 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade

Detects post-exploitation persistence and staging artifacts: Downloader1's COM-hijacked CLSID InProcServer32 registry write, SpyGlace v3.1.14's autorun path relocated to mimic a Windows certificate-store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs), and the Clouds.db file used to disguise staged screenshot captures as a cloud-sync database.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1546.015, T1036.005, T1113, T1082, T1027
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=13 OR EventCode=11)
| where (EventCode=13 AND match(TargetObject, "(?i)CLSID\\\{566296fe-e0e8-475f-ba9c-a31ad31620b1\}\\InProcServer32"))
   OR (EventCode=11 AND (match(TargetFilename, "(?i)SystemCertificates\\My\\CPLs") OR match(TargetFilename, "(?i)Windows\\Clouds\\Clouds\.db")))
| eval indicator_type=case(match(TargetObject,"CLSID"), "com_hijack_persistence", match(TargetFilename,"CPLs"), "spyglace_autorun_masquerade", match(TargetFilename,"Clouds\.db"), "screenshot_staging_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, TargetObject, TargetFilename, indicator_type
| where count > 0

Microsoft KQL

let ComHijack = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=RegistryKey, Detail=tostring(RegistryValueData), InitiatingProcess=InitiatingProcessFileName, IndicatorType="com_hijack_persistence";
let AutorunMasquerade = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"SystemCertificates\My\CPLs" or FolderPath has @"Windows\Clouds\Clouds.db"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Artifact=FolderPath, Detail=FileName, InitiatingProcess=InitiatingProcessFileName, IndicatorType=iff(FolderPath has "CPLs", "spyglace_autorun_masquerade", "screenshot_staging_masquerade");
ComHijack
| union AutorunMasquerade
| sort by Timestamp desc

Sigma

title: APT-C-60 COM-Hijack Persistence CLSID Registry Write
id: 3d4e5f6a-7b8c-49d0-a1e2-f3b4c5d6e7f8
status: experimental
description: Detects a registry write to the COM-hijacked CLSID InProcServer32 value used by APT-C-60's Downloader1 for persistence in the 2025 campaign wave against Japanese recruitment staff.
references:
    - https://blogs.jpcert.or.jp/en/2025/11/APT-C-60_update.html
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.persistence
    - attack.t1546.015
    - attack.t1036.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: 'CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32'
    condition: selection
falsepositives:
    - Legitimate re-registration of the same CLSID by an installer (extremely unlikely; this CLSID is attacker-hijacked and not owned by common COM servers)
level: high

Known false positives:

• Legitimate software installers occasionally rewrite unrelated CLSID InProcServer32 values, but reuse of this specific CLSID is not expected outside this campaign
• A legitimate certificate-management tool writing to the real Windows certificate store path (verify the exact 'CPLs' subdirectory and file hash before alerting)

Tuning notes: Pair the registry-event Sigma rule with a companion file_event rule for %appdata%\Microsoft\SystemCertificates\My\CPLs and %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db to cover the SpyGlace v3.1.14 autorun/screenshot-staging masquerade paths captured in the SPL/KQL forms; allowlist known certificate-management or backup agents that legitimately touch the real SystemCertificates store.

• 🔒 APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt · unlock with TL Creds
• 🔒 APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade · unlock with TL Creds
• 🔒 APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint · unlock with TL Creds
• 🔒 APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt · unlock with TL Creds
• 🔒 APT-C-60 COM-Hijack Persistence and SpyGlace Certificate-Store/Clouds.db Masquerade · unlock with TL Creds
• 🔒 APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint · unlock with TL Creds
• 🔒 APT-C-60 VHDX-Delivered LNK Loader Abusing Git LOLBin (gcmd.exe) to Run glog.txt · unlock with TL Creds
• 🔒 APT-C-60 C2 Beaconing via Statcounter Abuse, GitHub Dead-Drop, and ASP C2 Endpoint · unlock with TL Creds

Indicators of compromise for APT-C-60 Japanese Recruiter Lure

As of 2026-08-24, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2134.

Sample indicators (3 of 24)

• IP address: 185.181.230[.]71
• URL: hxxps://c[.]statcounter[.]com/13139439/0/1ba1a548/1/
• File hash: f102d490ad02b1588b9b76664cd715c315eaab33ac22b5d0812c092676242b15

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How APT-C-60 Japanese Recruiter Lure works

APT-C-60 is an East-Asia-focused cyber-espionage cluster (possibly a sub-cluster of the broader DarkHotel activity set per Positive Technologies and Chuangyu 404 Lab research) that has run recruitment-themed spear-phishing operations against Japanese organizations since at least August 2024, when JPCERT/CC first documented a campaign delivering a malicious VHDX file via Google Drive links to Japanese recruitment contacts, deploying SpyGlace v3.1.6 and abusing Bitbucket and Statcounter for C2 (C2 servers 103.6.244.46 and 103.187.26.176).

In the June-August 2025 wave analyzed here, the group evolved its delivery: rather than hosting the VHDX on Google Drive, the malicious virtual disk image (disguised as a candidate CV, e.g. 'CV & Professional Experience.vhdx') is now attached directly to the phishing email. Opening the VHDX and clicking the embedded LNK ('Resume.rtf.lnk') runs a command that changes into a bundled 'LICENSES.LOG\mingw64\bin' directory and pipes a script file (glog.txt) into the legitimate Git executable (renamed/invoked as gcmd.exe), a living-off-the-land technique that avoids dropping an obviously malicious binary.

The script chain retrieves two downloader stages: WebClassUser.dat (Downloader1), which builds a referrer string encoding the victim's volume serial number and computer name, beacons it to a public Statcounter tracking pixel (statcounter.com/13139439) and to attacker-controlled GitHub repositories (raw.githubusercontent.com URLs built from the same victim identifier) to fetch tasking, and persists via a COM-hijacked CLSID InProcServer32 registry value; and WebCacheR.tmp.dat (Downloader2), which XOR-decodes and loads the SpyGlace backdoor. SpyGlace (versions 3.1.12, 3.1.13, and 3.1.14 were observed being iterated and re-uploaded to GitHub between June 27 and July 16, 2025) supports AES-128-CBC-encrypted download commands, an initial beacon built from MD5/custom-RC4-encoded host data, remote beacon-interval tuning, DLL-module loading/unloading, and screenshot collection staged to a file disguised as a cloud-sync database (Clouds.db). Version 3.1.14 relocated its autorun persistence path to mimic a Windows certificate store directory (%appdata%\Microsoft\SystemCertificates\My\CPLs) and reworked its screenshot-upload routine.

Infrastructure for the 2025 wave combines GitHub accounts/repositories (used both to stage payloads and as a dead-drop for victim-specific tasking files) with a dedicated C2 server (185.181.230.71) serving ASP-based command endpoints, alongside continued abuse of the legitimate Statcounter web-analytics service for low-noise beaconing. Twelve distinct victim device identifiers were recoverable from the GitHub repositories used as dead drops. JPCERT/CC's report cross-references a September 2025 Sangfor writeup on SpyGlace v3.1.14 (a separate campaign outside Japan) and Positive Technologies' DarkHotel-cluster research correlating APT-C-60's TTPs with other suspected DarkHotel-affiliated groups (APT-C-60, APT-Q-12/'Pseudo Hunter'), which several open-source reports tentatively attribute to a South Korea-nexus actor; JPCERT/CC itself does not publish a nation-state attribution.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1132.001 Data Encoding: Standard Encoding; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Collection

T1113 Screen Capture

Persistence

T1546.015 Event Triggered Execution: Component Object Model Hijacking

Initial Access

T1566.001 Phishing: Spearphishing Attachment

Resource Development

T1585.003 Establish Accounts: Cloud Accounts; T1608.001 Stage Capabilities: Upload Malware

Remediation for APT-C-60 Japanese Recruiter Lure

Immediate actions

• Block outbound network connections to identified C2 IPs 185.181.230.71, 103.6.244.46, and 103.187.26.176 and the associated ASP endpoint paths under /wkdo9/
• Alert on and quarantine inbound email attachments with .vhd/.vhdx extensions, particularly disk images sent to recruitment/HR staff from unsolicited external senders claiming to be job applicants
• Hunt endpoints for the identified COM-hijack CLSID registry values (HKCU\Software\Classes\CLSID\{566296fe-e0e8-475f-ba9c-a31ad31620b1}\InProcServer32) and the SpyGlace/downloader mutex names

Workarounds

• Block or require justification for mounting of VHD/VHDX disk images delivered as email attachments at the mail-gateway or EDR policy layer
• Monitor and alert on writes to %appdata%\Microsoft\SystemCertificates\My\CPLs and %LocalAppData%\Microsoft\Windows\Clouds\Clouds.db, both used by SpyGlace to disguise its persistence and screenshot-staging artifacts

Longer-term hardening

• Restrict execution of git.exe (and other developer LOLBins) outside expected developer/CI contexts via application-control or Attack Surface Reduction rules, especially when invoked from a mounted virtual-disk image or LNK file
• Add DNS/web-proxy monitoring for anomalous beaconing patterns to raw.githubusercontent.com, statcounter.com, and bitbucket.org that encode host identifiers (volume serial + computer name) in the URL path or referrer header
• Run recurring spear-phishing awareness training for recruitment/HR personnel focused on fabricated CVs and unsolicited disk-image (VHD/VHDX) attachments

Affected and fixed versions

• N/A — Windows endpoints used by recruitment/HR staff (social-engineering campaign, not a software vulnerability)
  Vulnerable versions: N/A

Timeline of APT-C-60 Japanese Recruiter Lure

• 2022-06-01 locked-ioc-24 backdoor (TaskController.dll payload) first publicly attributed to APT-C-60 by ThreatBook researchers; the group has operated continuously since at least 2021.
• 2024-08-01 First documented recruitment-themed spear-phishing campaign against a Japanese organization: victims directed to download a malicious VHDX (containing LNK loader and decoy documents) from Google Drive; locked-ioc-24 v3.1.6 deployed with C2 over Bitbucket and Statcounter, using C2 servers locked-ioc-23 and locked-ioc-22.
• 2024-12-02 JPCERT/CC publishes 'Attack Exploiting Legitimate Service by APT-C-60,' the first detailed public writeup of the August 2024 campaign, TTPs, and IOCs.
• 2025-06-01 New campaign wave begins: APT-C-60 shifts VHDX delivery from a Google Drive download link to directly attaching the malicious VHDX (disguised as a CV, e.g. 'CV & Professional Experience.vhdx') to the phishing email.
• 2025-06-27 locked-ioc-24 v3.1.12 sample uploaded to an attacker-controlled GitHub repository for distribution.
• 2025-07-03 locked-ioc-24 v3.1.13 deployed in the ongoing campaign, iterating on the June build.
• 2025-07-16 locked-ioc-24 v3.1.14 released, relocating autorun persistence to a path disguised as a Windows certificate store directory (locked-ioc-13) and reworking the screenshot-upload routine to load from Clouds.db.
• 2025-08-31 JPCERT/CC's observed June-August 2025 campaign window against Japanese recruitment staff concludes; twelve distinct victim device identifiers recovered from attacker GitHub repositories.
• 2025-11-05 JPCERT/CC publishes 'Update on Attacks by Threat Group APT-C-60,' detailing the June-August 2025 campaign wave, updated locked-ioc-24 versions, new C2 infrastructure (locked-ioc-21), and IOCs; cross-references a September 2025 Sangfor analysis of locked-ioc-24 v3.1.14 in a separate overseas campaign and Positive Technologies' DarkHotel-cluster correlation research.

Sources cited for APT-C-60 Japanese Recruiter Lure

• DarkHotel: A cluster of groups united by common techniques global.ptsecurity.com · Research · 2025-01-01
• Update on Attacks by Threat Group APT-C-60 JPCERT/CC · Blog · 2025-11-05
• Attack Exploiting Legitimate Service by APT-C-60 JPCERT/CC · Blog · 2024-12-02
• APT-C-60 Deploys Updated SpyGlace Malware In Japan Espionage cyble.com · Blog · 2025-11-10
• APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign The Hacker News · News · 2024-11-01
• APT-C-60 Attacking Job Seekers to Download Weaponized VHDX File from Google Drive to Steal Sensitive Data cybersecuritynews.com · News · 2024-09-01
• Attack Group APT-C-60 Targets Japan Using Trusted Platforms infosecurity-magazine.com · News · 2024-12-05
• APT-C-60 Campaign: Malicious VHDX Hosted on Google Drive Lures Job Applicants gbhackers.com · News · 2024-09-05

Threats related to APT-C-60 Japanese Recruiter Lure

• SpyGlace Malware Campaign by APT-C-60 (Naikon) Abuses Trusted Developer Services (GitHub, GitLab, jsDelivr, Codeberg, Bitbucket) to Target Japan
• APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
• APT-C-60 Update: SpyGlace Campaign via VHDX Spear-Phishing Targeting Recruitment Staff in Japan/East Asia
• Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoors

Related coverage of this activity

• APT-C-60 SpyGlace campaign
• APT-C-60 Proton Drive SpyGlace

More from APT-C-60

• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation

Previous and next in apt

• FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation Previous report
• Khmer Shadow: Amber Saolao cluster targets Cambodian government with NIGHTFORGE loader and Havoc Demon Next report

Further reading

• Japanese Phishing Spoofs ANA, DHL, myTOKYOGAS